Modeling of Socio-cognitive Vulnerability of Human Organizations

1. Workshop on Complex Network and Infrastructure Protection, CNIP 2006 , 28- 29 March 2006, Rome, Italy 1 Modeling of Socio-cognitive Vulnerability of Human Organizations TOGA Meta-theory Approach Adam Maria Gadomski ENEA, It http://erg4146.casaccia.enea.it High-Intelligence & Decision research Group

2. 2 Keywords:vulnerability, human organization, management, decision-making, social, cognitive, human-caused threats, methodology, TOGA, LCCI. Abstract The paper dealing with the identification of the sources of vulnerability in human organizations. It is focused on the preliminary demonstration how a systemic unified computational methodological approach can be useful for the modeling of the vulnerability on individual, inter- and intra-organizational decisional levels in case of human-caused threats and organizational crisis. The modeling paradigms and framework of the Top-down Object-based Goal-oriented Approach (TOGA)[Gadomski, 1993]has been applied as a meta-modeling framework. "human self, threats to the self" Paper outline • Vulnerability Context  and Objectives • Basic concepts • Method: TOGA meta-theory • H-Organization Vulnerability - Socio-cognitive Framework • Conclusions

3. 3 1. Context  and Objective Socio-cognitive Perspective Organization -> inefficacy, h-errors  --> LCCIs Human organizations efficiency plays an essential role in the mitigation of disasters, calamities, energy blackouts and other large scale emergencies. The vulnerability of the emergency management organizations, such as, civil protections, local administrations, owners of large energy and telecommunication networks, is a critical but usually not well visible factor under the normal not extreme everyday conditions.  In the analysis of risks concerning large human-technology systems,  the probability of  human errors  becomes  dominating parameter in  the assessments of their reliability. Human organization socio-cognitive vulnerability can be seen as a state of the organization when possible dangerous events are able to cause either its wrong decisions or may lead to its internal crisis. Organization decisions are two types, individual and collective. They both involve many social constrains and depend on complex cognitive and psychological factors. The aim of this work is focused on the preliminary demonstration how a systemic unified computational methodological approach can be useful for the modeling of the vulnerability on inter- and intra-organizational decisional levels in case of human-caused threats and organizational crisis. The work is especially aimed at the needs of Large Complex Critical Infrastructures (LCCI) organizations.

4. 4 2. Basic concepts Short preliminary definitions Vulnerabilityis a lack of immunity or insufficient resistance on unexpected but possible events. Two basic types of vulnerability: A. Vulnerability on external events: dangerous situations, attacks, intrusions - human-based threats, natural threats, technological, market threats. B. Vulnerability on internal events: internal crisis, pathologies, and improper reorganization. Most frequently, organization is not prepared on A for the reason of B. From the perspective of internal events, the key factors responsible for the vulnerability are properties of organization itself and its employers. Crisis:is a complex situation/phenomenon where a routine management is not more efficient. Crisis creates a system with unknown functionality [Addis T. R.,1990] and behavior. Emergencyis characterized by well visible unacceptable levels of risk and losses generation caused by abnormal events and it requires not routine immediate interventions, called emergency management.They are or have to be performed during whole emergency state. The emergency state can be caused by internal events (crisis – as organization inefficacy) or external events as natural and technological disasters. In organization, usually a crisis states is mitigated by re-organizations, in contrary, it activates, sooner or later, an emergency state [3]. In such context, vulnerability is a readiness to a crisis state.

5. Efficacy Proper activity phase Re-organization Ef1 Vulnerability Ef2 Vulnerability Crisis Ef0 Pathological organization Healthy organization Time Organization in recovery Self-org phase 5 Socio-cognitive vulnerability appears when the organization members are not able together to produce decisions that satisfy their organization objectives. 2a. Human Organization Efficacy Human organizationis a system/network with explicitly established reciprocal dependencies between people, which, according to their competences, collaborate for achieving common objectives or realize predefined missions. The concepts: vulnerability, crisis and emergency are well visible in this generic h-orgnization life-cycle picture where they can be, in different manner, allocated to the organization phases. H-Organization Life-cycle Foundation Self-organization Proper Activity Re-organization Proper Activity Qualitative illustration. • We distinguish three necessary critical efficacy levels: • Survive efficacy, Ef0.- Emergency critical efficacy, Ef1 - Routine critical efficacy, Ef2 • (enables a bureaucratic functioning)

6. 6 Modelling Tool: Top-down Object-based Goal-oriented Approach 3. TOGA meta-theory • TOGA is a formal goal-oriented knowledge ordering meta-theory, it is focused on simulation & design of complex systems. It has three basic components: • - Theory of Abstract Objects (TAO) is a first level and a basic domain independent conceptualization system and a consensus building platform; • - Knowledge Conceptualization System (KNOCS), It includes TOGA’s ontology, i.e. axiomatic assumptions and basic conceptualization frameworks for the definition and decompositions of the real-world problem into an intelligent agent (IA) and domains of IA goal-oriented activities, i.e. the triple: (Intelligent Entity, Environment, Interactions) • Methodological Rules System (MRUS) for the specification (if not existing yet) or identification (if existing) of complex systems and problems; it indicates how TAO and KNOCS have to be used during the conceptual identification, specification and solution of real word problems. • The KNOCS meta-frameworks includes four modeling paradigms: • 1. Universal  Reasoning Frame Paradigm (URP), it is based on the IPK (Information, Preferences, Knowledge) architecture. • 2. Universal  Management Paradigm (UMP), it includes management functional definition and a conceptualization of the context of the managerial role. • 3. SPG Universal Domain Paradigm (UDP),  it is a framework of the conceptualization of the relation between an organization and its foundation-goal in terms of: systems, processes, functions and design-goals. • 4. WAG Universal Activity Paradigm (UAP) , conceptualization of the relation between a problem world and a goal of intervention of intelligent agent .

7. Domain of Activity n I P K goal 7 • Short IPK cell presentation • URP also includes IPK based • Decision-Making Model 3.1. Universal  Reasoning Paradigm - IPK URP is based on the  application of the data processing scheme to the human goal-oriented reasoning. It defines “elementary mind cell” and its components: Information, Preferences and Knowledge. Data – are everything what is/can be processed. Information, I - data which represent a specific property of the domain of human or artificial agent's activity . Preferences, P - Preference is an ordered relation among two properties of a real or abstract domain of activity of a cognitive agent. It indicates a property with higher utility or subjective importance. Knowledge, K- every abstract property of a human or artificial agent which has ability to process/transform a (quantitatively/qualitatively) information into other information. Every new Information is processed by Knowledge: In’ = K jn( In ), j=1, …J, for the domain  , where choice of K j depends on max.preferred state: max{P (In)} == Goal_state, and n indicates a conceptualization point-of-view. Fig.TheIPK cell it is an elementary component of the TOGA computational mind model. The structure is recursive and incremental.

8. K P Agent 1 I2 K K Agent 3 P Infrastructure Network I3 I I1 Agent 2 Real Emergency Domain P P K . . . . I – information system P – preferences system K – knowledge system In Agent Manager Agent N C P 8 Cooperation Example 3.1. Universal  Reasoning Paradigm - IPK We need to define: Manager, his/herRolein the organization structure, and Decision-making Different objectives, different tasks and different IPK [Balducelli,Gadomski,1993]

9. 9 SUPERVISOR tasks information cooperation MANAGER COOPERATING MANAGER expertises ADVISOR Knowledge Preferences information tasks The same structure INFORMER EXECUTOR Domain of management (Domain of activities) 3.2 Universal  Management Paradigm UMP is essential for decision-making Necessary components of the management process and their main interrelations according to UMP. It includes a cooperating-manager environment from the subjective perspective of a pre-selected decision-making manager.The figureis also a definition of characteristic property of a management role. ROLE def. IPK based definitions of the relative rolesand their main interrelations: role (competences, responsibility, privileges). Competence –professional knowledge Responsibility –preferences resulting from: tasks, duties in a preselected domain Privileges-access to the information and executive power. Every element of the UMP structure is subjective, incremental and recursive.

10. 10 3.2 Universal  Management Paradigm Role Modelling & Decision-Making • Complex situation: Every human-agent is in 3 roles together : • Organizational role – requested/defined by the structure (fixed) 2 .Informal role – applied, structure independent (variable) 3.Personal/real role – really realized (variable). Vulnerability Knowledge Base No action/response Meta-action/Pseudo-action Action adequate to D-M’er role and situation Decision-Making New Information or Task Decision-Making Preferences Base Cognitive Definitions [TOGA] an individual or group reasoning implied by the request/necessity of a choice caused by received information or task, or by delivered conclusion about possibility of risks/benefits. It is started when either choice criteria are unknown or alternatives are unknown and finished when choice is performed. Action-oriented decision-making:a decisional process when alternatives represent possible actions in pre-chosen physical domain. Mental decision-making: when the final choice refers not to actions but to conceptual objects related to a preselected domain of activity of intelligent agent. Group decision-making: when responsibility for decision is allocated to a group of intelligent agents and is based on shared decision-making process.

11. carrier relation ( it is opposite to the property relation) G F P S cause-consequence relation IA A IG T En 11 3.3 SPG Universal Domain Paradigm UDP: Framework of the Relation: (System –Process – Function - its Design/Fundation Goal) Function, F -is a goal-oriented property of an artificial system. Goal, G Process, P- is an identifiable or designed carrier of a function.System, S Every artificial system specification can be presented as 4 graph layers. This paradigm enables a structuring of specific information and domain-knowledge about a human organization and/or technological system. 3.4 WAG Universal Activity Paradigm UAP: Framework of the Relation: (Agent World–Task – Action - Intervention Goal) We have 4 graphs representing: IG,T, A, W specification/identification layers. Intervention Goal, IG – an expected state of W after the action A. Task, T –is an indication what has to be done by an intelligent entity. Action, A- is a connected sequence of acts performed by intelligent entity. It is a carrier of task. World. W – interacting couple: (Intelligent Agent, Environment) W One action may serve for different tasks. One task may be performed by different actions.

12. Generalization levels Problem Recognition Specialization Direction GF P S Subject Layers Intelligence Layer Information Layer Organization Objectives Goal Function Process System Physical Layer Social Expectations Conceptualization layers Specification Direction Identification Direction Employees Preferences 12 3.5 MRUS - Methodology TOGA Top Domain Conceptualization Space Basic Rules which define problem-solver perspective: Object-based Top-down Goal-oriented Top Example

13. - Improper Socio-Cognitive Communication - Improper IPK Using UMP SUPERVISOR tasks information cooperation MANAGER COOPERATING MANAGER expertises ADVISOR Knowledge Preferences Domain of Activity information tasks The same structure n I INFORMER EXECUTOR P K goal Domain of management (Domain of activities) 13 Identification of Socio-cognitive Vulnerabilities 4. H-Organization VulnerabilityModeling The presented modeling frames enable identification of different types of organizational vulnerability: on individual levels, for group d-m and cooper-intra-organizational. Using IPK • We may distinguish: • - Not sufficient information • - Not proper preferences • Not adequate competences (knowledge). • Improper communication

14. Conflicts of Roles Conflict of Interests/Motivations DifferRisk-Benefits modelling for Social interest Organization interest Personal interest Compromise, inefficient risky decisions. Necessity of negotiations Conflict of two or more IPK systems in different socio-cognitive perspectives . 14 4. H-Organization VulnerabilityModeling Identification of Socio-cognitive Vulnerabilities - Examples Dynamics of roles may create different lack of congruence between them & conflict of interests. Proper and Pathological Decisions Main classes: - meta-D-M , - pseudo D-M, - proper D-M. Pathologies are related to: - response on source type ( “safety source” filters ); - response on subject ( lack of competences, emotional reaction, out ofInterest).  - response according domain-preferences (organizational/personal role):proper DM. Controllability & updating of Ethics concept If D-M autonomy increases then: Efficacy of Control decreases & Importance of Ethics and personal motivation increases. This rule indicates importance of Motivation Management.

15. G F P S Its main objective is Scenario Building and first identification of symptoms of a crisis and vulnerability. We may recognize and improve organization emergency instructions, procedures and , in consequence, to plan/design Decision Support Network. Using UDP 15 4. H-Organization VulnerabilityModeling Identification of Socio-cognitive Vulnerabilities Using UDP We may recognize improper organization structures and to plan re-organizations Application TOGA we are able to start the identification of vulnerabilities, to simulate organization dynamics(What-if) and take under considerationhuman factors, such as: risk perception, individual interests, motivations and emotional characteristics of decision-makers. 5. Conclusions The presented study are yet in the initial phase. More detailed, but always preliminary results and the References are included in the article, in the Proceedings of the CNIP’06 Workshop. The TOGA approach seems to be especially promising for the vulnerability investigation in high-risk and LCCIs organizations. The work has been performed in frame of the CRESCO & EU IRRIIS Projects.